Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 24 of 86
Jan 23, 2026Suggestion Toolkit: Missing AuthorizationCVE-2026-24622 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Suggestion Toolkit: from n/a through <= 5.0.
- Product
- Suggestion Toolkit
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Suggestion Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026PopCash.Net Code Integration Tool: Missing AuthorizationCVE-2026-24619 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PopCash.Net Code Integration Tool: from n/a through <= 1.8.
- Product
- PopCash.Net Code Integration Tool
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update PopCash.Net Code Integration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Popups: Missing AuthorizationCVE-2026-24616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Popups: from n/a through <= 2.2.0.5.
- Product
- WP Popups
- Affected
- up to 2.2.0.5
- What to do
- Affects up to 2.2.0.5. Update WP Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Cream Magazine: Missing AuthorizationCVE-2026-24615 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Magazine: from n/a through <= 2.1.10.
- Product
- Cream Magazine
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Cream Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.6.
- Product
- Ecwid Shopping Cart
- Affected
- up to 7.0.6
- What to do
- Affects up to 7.0.6. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Orchid Store: Missing AuthorizationCVE-2026-24612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through <= 1.5.15.
- Product
- Orchid Store
- Affected
- up to 1.5.15
- What to do
- Affects up to 1.5.15. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Travel Monster: Missing AuthorizationCVE-2026-24607 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through <= 1.3.3.
- Product
- Travel Monster
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Travel Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-24606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.
- Product
- Bayarcash WooCommerce
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026X Addons for Elementor: Missing AuthorizationCVE-2026-24605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.
- Product
- X Addons for Elementor
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Simple GDPR Cookie Compliance: Missing AuthorizationCVE-2026-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through <= 2.0.0.
- Product
- Simple GDPR Cookie Compliance
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Simple GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Universal Google Adsense and Ads manager: Missing AuthorizationCVE-2026-24603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Google Adsense and Ads manager: from n/a through <= 1.1.8.
- Product
- Universal Google Adsense and Ads manager
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Universal Google Adsense and Ads manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Multilanguage by BestWebSoft: Missing AuthorizationCVE-2026-24598 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multilanguage by BestWebSoft: from n/a through <= 1.5.2.
- Product
- Multilanguage by BestWebSoft
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Multilanguage by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Zoho CRM Lead Magnet: Missing AuthorizationCVE-2026-24595 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.8.1.9.
- Product
- Zoho CRM Lead Magnet
- Affected
- up to 1.8.1.9
- What to do
- Affects up to 1.8.1.9. Update Zoho CRM Lead Magnet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Smart Product Viewer: Missing AuthorizationCVE-2026-24588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Product Viewer: from n/a through <= 1.5.4.
- Product
- Smart Product Viewer
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Smart Product Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026AJAX Hits Counter + Popular Posts Widget: Missing AuthorizationCVE-2026-24587 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Hits Counter + Popular Posts Widget: from n/a through <= 0.10.210305.
- Product
- AJAX Hits Counter + Popular Posts Widget
- Affected
- up to 0.10.210305
- What to do
- Affects up to 0.10.210305. Update AJAX Hits Counter + Popular Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Hyyan WooCommerce Polylang Integration: Missing AuthorizationCVE-2026-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hyyan WooCommerce Polylang Integration: from n/a through <= 1.5.0.
- Product
- Hyyan WooCommerce Polylang Integration
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Hyyan WooCommerce Polylang Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026SumUp Payment Gateway For WooCommerce: Missing AuthorizationCVE-2026-24583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through <= 2.7.9.
- Product
- SumUp Payment Gateway For WooCommerce
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update SumUp Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Points and Rewards for WooCommerce: Missing AuthorizationCVE-2026-24581 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through <= 2.9.5.
- Product
- Points and Rewards for WooCommerce
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.5.
- Product
- Ecwid Shopping Cart
- Affected
- up to 7.0.5
- What to do
- Affects up to 7.0.5. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2026-24579 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Admin login URL Change: Missing AuthorizationCVE-2026-24578 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through <= 1.1.5.
- Product
- Admin login URL Change
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Admin login URL Change to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Pie Register: Missing AuthorizationCVE-2026-24577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.
- Product
- Pie Register
- Affected
- up to 3.8.4.8
- What to do
- Affects up to 3.8.4.8. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026BOX NOW Delivery: Missing AuthorizationCVE-2026-24571 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BOX NOW Delivery: from n/a through <= 3.0.2.
- Product
- BOX NOW Delivery
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update BOX NOW Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Edwiser Bridge: Missing AuthorizationCVE-2026-24570 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edwiser Bridge: from n/a through <= 4.3.2.
- Product
- Edwiser Bridge
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Media Library File Size: Missing AuthorizationCVE-2026-24569 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Library File Size: from n/a through <= 1.6.7.
- Product
- Media Library File Size
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Media Library File Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Travel: Missing AuthorizationCVE-2026-24568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 11.1.0.
- Product
- WP Travel
- Affected
- up to 11.1.0
- What to do
- Affects up to 11.1.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Anything Order by Terms: Missing AuthorizationCVE-2026-24567 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through <= 1.4.0.
- Product
- Anything Order by Terms
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Anything Order by Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026iNET Webkit: Missing AuthorizationCVE-2026-24566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iNET Webkit: from n/a through <= 1.2.4.
- Product
- iNET Webkit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026LifePress: Missing AuthorizationCVE-2026-24563 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through <= 2.2.1.
- Product
- LifePress
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update LifePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ryviu – Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-24562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu – Product Reviews for WooCommerce: from n/a through <= 3.1.26.
- Product
- Ryviu – Product Reviews for WooCommerce
- Affected
- up to 3.1.26
- What to do
- Affects up to 3.1.26. Update Ryviu – Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026FluentBoards: Missing AuthorizationCVE-2026-24561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.1.
- Product
- FluentBoards
- Affected
- up to 1.91.1
- What to do
- Affects up to 1.91.1. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Cloudinary: Missing AuthorizationCVE-2026-24560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloudinary: from n/a through <= 3.3.2.
- Product
- Cloudinary
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Cloudinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026ElementCamp: Missing AuthorizationCVE-2026-24556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.
- Product
- ElementCamp
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update ElementCamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Monetag Official: Missing AuthorizationCVE-2026-24551 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026HD Quiz: Missing AuthorizationCVE-2026-24544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a through <= 2.0.9.
- Product
- HD Quiz
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update HD Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Materialis Companion: Missing AuthorizationCVE-2026-24543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.
- Product
- Materialis Companion
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Download After Email: Missing AuthorizationCVE-2026-24541 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through <= 2.1.9.
- Product
- Download After Email
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Integrate Google Drive: Missing AuthorizationCVE-2026-24540 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through <= 1.5.6.
- Product
- Integrate Google Drive
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Protección de datos – RGPD: Missing AuthorizationCVE-2026-24539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68.
- Product
- Protección de datos – RGPD
- Affected
- up to 0.68
- What to do
- Affects up to 0.68. Update Protección de datos – RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Automatic Featured Images from Videos: Missing AuthorizationCVE-2026-24535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Booter: Missing AuthorizationCVE-2026-24534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: from n/a through <= 1.5.7.
- Product
- Booter
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Booter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2026-24532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.2.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WebP Conversion: Missing AuthorizationCVE-2026-24530 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through <= 2.2.
- Product
- WebP Conversion
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WebP Conversion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Quick Restaurant Reservations: Missing AuthorizationCVE-2026-24529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through <= 1.6.7.
- Product
- Quick Restaurant Reservations
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Quick Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026CLP Varnish Cache: Missing AuthorizationCVE-2026-24525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.
- Product
- CLP Varnish Cache
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CLP Varnish Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Tablesome: Missing AuthorizationCVE-2026-24524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.2.8.
- Product
- Tablesome
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Subscribe: Missing AuthorizationCVE-2026-24522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.
- Product
- WP Subscribe
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update WP Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WPMasterToolKit: Missing AuthorizationCVE-2026-24388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through <= 2.14.0.
- Product
- WPMasterToolKit
- Affected
- up to 2.14.0
- What to do
- Affects up to 2.14.0. Update WPMasterToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Quick Post Duplicator: Missing AuthorizationCVE-2026-24387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through <= 2.1.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Element Invader – Template Kits for Elementor: Missing AuthorizationCVE-2026-24386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Invader – Template Kits for Elementor: from n/a through <= 1.2.4.
- Product
- Element Invader – Template Kits for Elementor
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Element Invader – Template Kits for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.